An email does not have to look badly written to be a scam. If it asks you to change a payment, enter a password or act before an account is closed, it is worth checking the request through another channel.
Cyber Smart Week ran from 5 to 11 October. In its announcement on 30 September, the National Cyber Security Centre encouraged New Zealanders to build simple habits for recognising scams. The week has finished, but those habits are useful all year. NCSC Cyber Smart Week announcement
Good spelling is not enough
The NCSC’s Cyber Threat Report announcement on 24 September describes AI being used to make phishing and other attempts to deceive people more convincing. Poor spelling may still be a warning sign, but a polished email is not evidence that a request is genuine. NCSC Cyber Threat Report announcement
Think about what the message is asking you to do. Is a supplier changing their bank account? Is someone asking you to log in to fix an email problem? Is an unexpected request being presented as too urgent to check?
Check the request separately
For a change of bank details, call the supplier on a number you already have. Do not rely on the number supplied in the message you are checking. An invoice scam can involve access to a genuine business email account, so a familiar sender alone is not enough. Own Your Online invoice scam guidance
For an account warning, open the service using your usual bookmark or type its known address yourself. If you are unsure, contact the provider through the details you normally use. You do not need to click the email’s link to find out whether there is a problem.
Make checking part of the job
A small business does not need a complicated policy to start. Agree who can approve a payment change and how it will be confirmed. Make it normal for someone to ask a colleague before acting on an unusual request.
It is also worth checking that multi-factor authentication is enabled on business email and other important accounts. The NCSC includes this, backups and an incident plan among the basics organisations should have in place. These measures reduce risk; they do not make every request safe. NCSC Cyber Smart Week announcement
If something has already happened
If you have made a payment you now believe was a scam, contact your bank promptly. If you entered an account password, contact the service provider or your IT support so they can help secure the account. You can also report the issue to the NCSC. Report an issue to the NCSC
If an email claims there is a problem with a website or hosting service we manage for you, get in touch through our usual contact details. We can check the claim before you take the next step.
